Pwdump 6 is able to extract NTLM and LanMan hashes from a
Windows target, regardless of whether Syskey is enabled. It is also capable of
displaying password histories if they are available. It outputs the data in
L0phtcrack-compatible form, and can write to an output file.